What is eDiscovery, and why is it important in modern litigation? How does the eDiscovery process work, and what do terms like “ESI”, “metadata”, “legal hold”, and “technology-assisted review” mean?
This eDiscovery glossary answers common questions about electronic discovery by defining the key concepts, technologies, and workflows used to identify, preserve, collect, process, review, and produce electronically stored information (ESI). Designed for attorneys, paralegals, and legal teams, this guide provides clear explanations of essential eDiscovery terminology to help professionals better understand the processes that support today’s litigation and investigations.
A
Active Data: Electronically stored information (ESI) that is currently accessible and available for collection during eDiscovery without specialized recovery techniques. Examples include user-created files, emails, databases, and documents stored on active systems, servers, or cloud platforms.
Admissible: Evidence that is allowable in court.
Analytics: The various technologies used to provide multiple views into a data set.
Archival Data: Electronically stored information (ESI) maintained for historical, regulatory, or business purposes that is outside an organization’s active systems. Because it may reside on backup systems, removable media, or other storage platforms, retrieving archival data may require additional technical processes before it can be reviewed or collected for eDiscovery.
Artificial Intelligence (AI): In eDiscovery, it refers to technologies designed to replicate human reasoning, language understanding, and decision-making processes to assist with the analysis of electronically stored information (ESI). AI-powered eDiscovery solutions use machine learning (ML), natural language processing (NLP), and generative AI (GenAI) to identify patterns, classify documents, improve search accuracy, and accelerate review workflows
Assisted Review: This method of review utilizes advanced machine learning, including predictive coding, in order to apply reviewers’ coding decisions to large amounts of data.
Attachment: A document or file that is connected to another document or file either externally, e.g. a document connected to an email, or embedded, e.g. an image in a word processing document.
Attachment Backup: Both the action of and the result of creating a copy of data as a precaution against the loss or damage of the original data.
B
Backup Tape: Portable media used to store copies of data that are created as a precaution against the loss or damage of the original data.
Batching: The process of gathering large amounts of electronically stored information together in batches. Typically, this process is done so that documents can be allocated to reviewers for tagging.
Bates Number: A document identification method that applies unique, sequential alphanumeric labels to individual pages or files during discovery. These identifiers help parties reference, organize, and track produced documents throughout litigation.
Big Data: Term used to describe data sets so large and complex that it becomes difficult to process them using traditional data processing applications.
Boolean Search: This technique is used to connect individual keywords or phrases with a single query, used to avoid false positives, and accurately pinpoint documents of interest. Typical connectors are terms such as AND, OR, and NOT.
C
Chain of Custody: The order in which a piece of criminal evidence should be handled by persons investigating a case, specifically the unbroken trail of accountability that ensures the physical security of samples, data, and records in a criminal investigation.
Child Document: A file that is attached to another communication file, e.g. the attachment to an email or a spreadsheet imbedded in a word processing document.
Civil Procedure Rules (CPR): The Federal Rules of Civil Procedure govern civil proceedings in the United States District Courts. Their purpose is “to secure the just, speedy, and inexpensive determination of every action and proceeding.”
Cloud: A network connection providing access to computers and software applications.
Cloud Computing: The practice of using a network of remote servers hosted on the Internet to store, manage, and process data, rather than a local server or a personal computer.
Coding (Objective/Subjective): The method of entering fields of information from a document and saving them in a format that will be linked to that particular document within a database. There are different types of coding: objective and subjective. Objective coding is coding applied by anyone who can read the language of the document such as a date on a scan. Subjective coding requires knowledge of the underlying investigation, such as, “Is this information good for our case?”
Collect, Collection: Gathering electronically stored information (ESI) for discovery.
Compliance: Efforts by organizations to comply with laws, policies, and regulations.
Conceptual Analytics: An advanced eDiscovery technology that identifies documents based on their meaning and context rather than exact keywords. By analyzing the relationships between words and concepts, conceptual analytics helps legal teams uncover relevant documents that traditional keyword searches may miss, improving the accuracy and efficiency of document review.
Container File: This is a single file that contains multiple other files or documents, such as a zip file. Container files are typically used due to their considerably smaller file size. Extracted contents are usually anywhere from 50% to 250% larger in size than the original container file.
Continuous Active Learning (CAL): An AI-driven, iterative document review method. Instead of requiring a massive upfront training set, CAL uses human feedback in real-time. For example, as a reviewer codes documents, the algorithm immediately learns, reprioritizes the remaining dataset, and surfaces the next most relevant documents.
Counsel (Inside/Outside): Counsel refers to legal representation. Inside counsel refers to attorneys who work inside a corporation and outside counsel refers to legal representation who work outside of the corporation, typically for a law firm.
Custodian: Refers to the individual who has electronically stored information relevant to the pending litigation.
D
Data Collection (also Data Acquisition): The systematic, defensible process of identifying, gathering, and securing digital evidence from devices, networks, applications, or cloud environments. The goal is to extract relevant information for investigation or analysis while preserving the integrity of the original data and ensuring that evidence is not altered, compromised, or contaminated.
Data Culling: The process of eliminating files from a collection of electronic files to reduce the number of documents to be reviewed. Culling techniques include de-duplication, near-de-duplication, email thread analysis, deNISTing, and filtering.
Data Extraction: The process of parsing data from electronic documents to identify their metadata and body contents.
Data Integrity: Maintaining accuracy of data through its lifecycle.
Data Mapping: The process of identifying and recording the location and types of electronically stored information within an organization’s network, and policies and procedures related to that information.
Data Security: The protection of digital data from access or alteration by unauthorized parties.
Deduplication (Deduping): The process of comparing the characteristics of electronic documents to identify and/or remove duplicate records to reduce review time and increase coding consistency. Removes all files from the data set that contain the same hash value and are deemed to be exact duplicates.
DeNISTing: The process of separating documents generated by a computer system from those created by a user. This automated process utilizes a list of file extensions developed by the National Institute of Standards and Technology (NIST).
Discovery: The process of identifying, securing, and reviewing information that is potentially relevant to a legal matter and producing information that can be utilized as evidence in the legal process.
Document Family: All parts of a group of documents that are connected to each other for purposes of communication, e.g. an email and its attachments.
E
Early Case Assessment (ECA): The tools or methods used for investigating and quickly learning about document collection for the purposes of estimating the risks, costs, and time spent pursuing a particular legal course of action.
Electronic Discovery (eDiscovery): The process of discovery in civil litigation, in which electronically stored information is identified, collected, prepared, reviewed, and produced in the context of a legal or investigative process.
Electronic Discovery Reference Model (EDRM): The standard, globally recognized framework that outlines the lifecycle of eDiscovery. It breaks down the process of finding, securing, and analyzing digital evidence (electronically stored information or ESI) into distinct, defensible, and cost-effective stages for legal and regulatory proceedings.
Electronic Evidence: Information that is stored in an electronic format. This is used to prove or disprove the facts of a legal matter.
Electronically Stored Information (ESI): Information stored in digital form, e.g. on computers and storage devices.
Email: An electronic communication sent or received via a data application designed for that purpose, e.g. MS Outlook, Google Gmail.
Email Threading: The process of compiling all the emails in a dataset and organizing them into conversations. Email threading can dramatically increase review speeds of email data by having the entire conversation reviewed by one reviewer, as well as the ability to read the final inclusive email, as opposed to separate conversation pieces.
Endpoint: Computer hardware device on an IP network (laptops, desktops, smart phones, tablets, etc.).
F
Filtering: The process of applying specific parameters to remove groups of documents that do not fit those parameters, in order to reduce the volume of the data set, e.g. date ranges and keywords.
Forensic Collection: The process of identifying, collecting, and preserving electronically stored information (ESI) using industry-accepted methods that maintain the integrity and authenticity of the data. These practices help ensure the evidence is defensible and admissible in legal proceedings.
Forensic Image: An exact, bit-for-bit copy of a digital storage device that captures all data, including active files, deleted files, file fragments, and unallocated or slack space. Because it preserves the device’s contents without altering the original, a forensic image is commonly used during digital investigations and legal proceedings.
Forensics: The process of identifying, collecting, preserving, examining, and analyzing electronically stored information (ESI) using scientifically sound methods that protect the data's integrity and authenticity, helping ensure it is admissible as evidence in legal proceedings.
Federal Rules of Civil Procedure (FRCP): The rules that govern eDiscovery and other aspects of the civil legal process in United States District Courts.
G
General Counsel (GC): Head corporate lawyer at a company. Sometimes called Chief Legal Officer. An executive level position on par with a vice president or a C-level officer.
General Data Protection Regulations (GDPR): The GDPR provides several broad protections for the personal data of European residents, including the right to access one’s data and the right to have one’s data erased. It requires that companies justify their possession of personal data and carefully control what they do with it.
Generative AI: The use of advanced AI models, including large language models (LLMs), to analyze, summarize, and extract insights from electronically stored information (ESI). By allowing users to interact with data through natural language prompts, GenAI can assist with tasks such as document summarization, privilege identification, information retrieval, and case analysis, helping legal teams improve efficiency throughout the litigation workflow.
H
Harvesting: Also referred to as the collection of electronically stored information. Harvesting is the method of gathering electronic data for future use in your investigation or lawsuit, preferably while maintaining file and system metadata.
Hash (also Hash Coding, Hash Value): An algorithm that generates a unique value for each document. It is referred to as a digital fingerprint and is used to authenticate documents and to identify duplicate documents. During eDiscovery, hash values help confirm that data has not been altered and allow processing tools to identify and remove exact duplicate files, reducing the volume of data requiring review.
Hold: Keeping items possibly pertinent to a matter in a safe and secure condition to be collected and used in discovery.
Hosting: Defines a service provided by a third-party litigation support firm that provides access to documents relating to a particular matter within a review software platform. The platform can be accessed via the internet by logging in with a username and password.
I
Identification: The process of learning the location of all data which a law firm or client may have a duty to preserve and potentially disclose in a pending or prospective legal proceeding. This is typically done during the interview phase of a legal hold.
Image (Drive): To make an identical copy of a drive including its empty space; “mirror image.”
Image (File): To make a picture copy of a document. The most common image formats in eDiscovery are TIFF and PDF.
In-house: Corporate legal teams (contrasted against external law firms).
Information Governance (IG): Policies that affect the creation, management, and disposition of electronic and paper records.
Internet of Things (IoT): The interconnection via the Internet of computing devices embedded in everyday objects, e.g., Amazon Alexa or Apple Watch, enabling them to send and receive data.
L
Large Language Model (LLM): An advanced artificial intelligence (AI) technology that uses deep learning to understand and process human language. Unlike traditional keyword-based search methods, LLMs can evaluate context, concepts, and relationships within electronically stored information (ESI), enabling more efficient document analysis, review, and discovery workflows.
Legacy Data (also Legacy System): Data whose format has become obsolete.
Legal Hold: A communication requesting the preservation of information that is potentially relevant to a current or reasonably anticipated legal matter and the resulting preservation.
Legal Tech: The use of technology and software to provide legal services.
Linear and Nonlinear Review: Methods used by legal teams to evaluate documents during the eDiscovery process. Linear review involves reviewing every document in a collection in a sequential manner, while nonlinear review leverages technology, including search tools, analytics, and technology-assisted review (TAR), to narrow large data sets and direct reviewers toward information most likely to be relevant.
Load File: A file used to import data into an eDiscovery system. It defines document parameters for imaged documents and often contains metadata for all electronically stored information (ESI) it relates to.
M
Machine Learning (ML): A subset of artificial intelligence (AI) that uses algorithms to analyze large volumes of electronically stored information (ESI), identify patterns, categorize documents, and predict relevance based on learned examples rather than explicit programming. In eDiscovery, machine learning helps automate and streamline document review by allowing software to learn from human decisions and prioritize potentially relevant information.
Media: Devices used to store electronic information, e.g. hard drives, back up tapes, and DVDs.
Metadata: Often referred to as data about data, it is the information that describes the characteristics of electronically stored information, e.g. sender, recipient, author, date.
N
Native Format: A file that is maintained in the format in which it was created. This format preserves metadata and details about the data that might be lost when the documents are converted to image format, e.g. pivot tables in spreadsheets.
Native File: An electronic document or data file maintained in the original format created by its source application. Unlike converted formats such as PDF or TIFF, native files preserve the original content, formatting, functionality, and metadata. Common examples include Microsoft Word (.docx), Microsoft Excel (.xlsx), and Microsoft Outlook email (.msg).
Natural Language Processing (NLP): A branch of artificial intelligence (AI) that enables computers to understand, interpret, and analyze human language. In eDiscovery, NLP is used to process large volumes of unstructured electronically stored information (ESI), helping identify relevant information, improve search capabilities, automate aspects of document review, and uncover insights within legal data collections.
Near-Duplicate: Two or more files that contain a specified percentage of similarity. Also, the process used to identify those nearly identical files.
NIST List: The National Software Reference Library published by the National Institute of Standards and Technology (NIST) of the U.S. Department of Commerce. These are common software files, such as operating system commands, libraries, and application executables and data files, designated non-discoverable or irrelevant to discovery because they contain no data that can be deemed as evidence to an action.
Normalization: Reformatting data so that it is stored in a standardized format.
O
Optical Character Recognition (OCR): The process of converting images of printed pages into electronic text.
P
Parent Document: A document to which other documents/files are attached.
Personal Storage Table (PST): A file format used to store copies of messages, calendar events, and other items within Microsoft software (like Microsoft Outlook, Microsoft Exchange Client, and Windows Messaging).
Portable Document Format (PDF): A file format that displays documents, including text and images, in an electronic form, independent of the software, hardware, or operating system the viewer is using.
Predictive Coding: This document categorization process is the combination of machine-learning technology and workflow methods that use keyword search, filtering, and sampling to automate portions of an eDiscovery document review aiming to reduce the number of non-responsive and irrelevant documents.
Precision: In search results analysis, precision is the measure of the level of relevance to the query in the results set of documents.
Preservation: The process of identifying and protecting electronically stored information (ESI) to prevent its alteration, deletion, or destruction when litigation, an investigation, or another legal matter is reasonably anticipated.
Privileged Information: Confidential communication or documentation that is protected from disclosure during the discovery process. Identifying and withholding privileged materials is a critical part of document review to prevent the inadvertent production of protected information.
Privilege Log: A document that identifies materials withheld from discovery because they’re protected by a legal privilege, such as attorney-client privilege or the attorney work product doctrine. It includes enough descriptive information – such as the document’s date, author, recipients, and general subject matter – to allow opposing counsel and the court to evaluate the privilege claim without revealing the protected content.
Processing: The eDiscovery workflow which ingests data, extracts text and metadata, and normalizes the data. Some systems include data indexing and de-duplication in their processing workflow.
Production: To make items which have been collected ready to deliver to a party, usually after they have been redacted as part of the discovery of the defendant or claimant. The production set consists of items that are responsive to the opposition’s request for documents, but not privileged.
Proportionality: Belief that the costs of a legal case should be related to its importance and value.
Q
Query: A formally phrased question.
R
Recall: In search results analysis, recall is the measure of the percentage of total number of relevant documents in the corpus returned in the results set.
Redaction: The process of removing or obscuring sensitive information from electronically stored information (ESI) before production. It allows responsive documents to be produced while protecting privileged content, confidential information, and data subject to privacy or regulatory requirements.
Request for Production of Documents: During discovery, a party may request that another party produce items pertaining to the matter. This is accomplished by providing the party with a formal request.
Review: During discovery, the producing parties are responsible for reviewing every item identified as potentially relevant to the matter and identifying those that are responsive to the request for production.
S
Search: The process of looking within a data set using specific criteria (a query). There are several types of search ranging from simple keyword to concept searches that identify documents related to the query, even when the query term is not present in the document.
Slack Space: The unused portion of a disk that exists when the data does not completely fill the space allotted for it. This space can be examined for otherwise unavailable data.
Social Discovery: Defined as the discovery of electronically stored information on the various social media sites used today, including but not limited to Facebook, Twitter, YouTube, LinkedIn, and Instagram.
Spoliation: The destruction or alteration of evidence, or the failure to preserve the evidence properly.
Structured Data: Data stored in a structured format such as a database. Structured data can create challenges in eDiscovery.
System Files: An electronic file that is part of the operating system or other control program. These files are created by the computer, not the user of the computer. The most popular system files on a Windows computer include msdos.sys, io.sys, ntdetect.com, and ntldr.
T
Tagged Image File Format (TIFF): This file format allows storage of multiple bitmap images and introduces no compression artifacts, making it ideal for archiving intermediate files. TIFF images are the most common file formats for scanned hard copy documents.
Tagging: The process of assigning classifications, such as by relevance or privilege, to one or more documents.
Technology Assisted Review (TAR): Also known as computer-assisted review or predictive coding, this process uses software to sort through data for discovery purposes.
Text Extraction: The process of extracting readable text from electronically stored information (ESI), including emails, documents, spreadsheets, presentations, and PDFs. The extracted text is indexed to enable keyword searching, analytics, technology-assisted review (TAR), and efficient document review while preserving the original file.
U
Unallocated Space: Most often, this is space created on a hard drive when a file is marked for deletion. This space is no longer allocated to a specific file. Until it is overwritten, it still contains the previous data and can often be retrieved.
Unicode: The code standard that provides for uniform representation of character sets for all languages. It is also referred to as double-byte language.
Unitization: The process of splitting image files received in multiple page formats down into individual “documents.”
Unstructured Data: Information that does not exist in the usual row-column database. These text and multimedia data files, such as webpages, videos, audio files or videos, lack the ability to be organized effectively within a database, hence the name “unstructured.”
W
Work Product: All the writing that a lawyer creates on behalf of a party to a matter. Work product is privileged.